CVE-2026-91768 PHP Group CVE debrief

Who should care

Defenders responsible for configuring and securing FastCGI client access checks should verify IPv6 address filtering and review allowed_clients configuration. This includes checking for /96 prefix matches and updating allowed_clients configuration to exact address matches if necessary. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for .

Why it matters

CVE-2026-91768 allows an attacker to bypass FastCGI client access checks using IPv6 addresses, potentially leading to unauthorized access. Defenders should verify IPv6 address filtering and review allowed_clients configuration to prevent exploitation.

• An attacker may reach the FastCGI endpoint by sourcing an address sharing the first 96 bits with an allowed one
• Verify IPv6 address filtering for FastCGI client access checks to prevent unauthorized access

Technical summary

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, allowing an attacker who can source an address sharing the first 96 bits with an allowed one to pass the check and reach the FastCGI endpoint. This issue affects defenders who need to verify IPv6 address filtering and review allowed_clients configuration to prevent exploitation. The CVE record and NVD entry provide details on the IPv6 address comparison issue in FastCGI client access checks, and defenders should review compensating controls for exposed systems.

Defensive priority

Verify IPv6 address filtering for FastCGI client access checks

Recommended defensive actions

• Verify IPv6 address filtering for FastCGI client access checks
• Review allowed_clients configuration for /96 prefix matches
• Update allowed_clients configuration to exact address matches if necessary
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the IPv6 address comparison issue in FastCGI client access checks. The issue allows an attacker to bypass checks using IPv6 addresses sharing the first 96 bits with an allowed one. Defenders should verify IPv6 address filtering and review allowed_clients configuration to prevent exploitation. The CVE Program and NVD records provide source-provided CVE metadata and official vulnerability details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.